Browser-deployed WebAssembly (wasm) modules often inherit memory-safety bugs from C and C++-style code, yet exploiting, and even reaching, these bugs in the Web threat model is fundamentally \emph{context-dependent}. JavaScript (JS) controls the exported-call schedule and constructs the wasm entry state, including arguments, globals, and linear-memory layouts, from attacker-influenced web inputs. This makes both wasm-only analysis, which assumes static initial states, and prior browser-based testing such as Wemby ineffective. Wemby generates a fixed, wasm-agnostic context pool and then only mutates wasm parameters, which limits its ability to systematically reach deeper, wasm-relevant contexts and gated behaviors.

We present SymWeb, a feedback-guided closed-loop system that links \emph{external inputs} to \emph{browser-reachable JS-induced wasm contexts} and then to \emph{context-aware wasm symbolic execution}. SymWeb couples an \emph{Feedback-driven Context Generator} with an \emph{Context-aware Wasm Symbolic Executor}. The context generator performs binary rewriting for ASan-like checks and observability, collects contexts in the browser, and applies influence-guided input mutation. The symbolic executor clusters and symbolizes contexts, performs coverage-guided symbolic execution under reachable entry states, and returns actionable constraints to steer the next online round.

We evaluate SymWeb on 30 real-world wasm-enabled websites. Under our Web threat model, SymWeb verifies 17 exploitable vulnerabilities and achieves 72.8% average wasm basic-block coverage. Compared to the browser-based baseline Wemby, SymWeb finds \textbf{8} more verified vulnerabilities and improves coverage by \textbf{19.9} percentage points. Compared to the wasm-only baseline WASEM, SymWeb finds \textbf{14} more verified vulnerabilities and improves coverage by \textbf{40.4} percentage points. Overall, these results show that closing the loop between browser-reachable context generation and context-aware wasm analysis substantially improves both vulnerability-finding effectiveness and exploration depth in real Web environments.